Analysis
-
max time kernel
147s -
max time network
135s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
23-07-2021 12:50
Static task
static1
Behavioral task
behavioral1
Sample
Documents pdf.exe
Resource
win7v20210410
General
-
Target
Documents pdf.exe
-
Size
533KB
-
MD5
027d8e07155bc564f7b522183018efe6
-
SHA1
10348a89cc88e0911f507a2d4aa50071718b096c
-
SHA256
90e7c97ea4917a6efb5c0a69bd6f481b1a5023d6f8ad0f22d123c417edff8a68
-
SHA512
5d1c8f6f0121df79767de6de22e7f513972aceeafd7376086511c8575187e224190a408340ec57835e9c0e0a347d47d7e4fd70c8618f91cf638c23b3acc5c3d3
Malware Config
Extracted
formbook
4.1
http://www.valiantfinancial.net/hth0/
grahamandjana.com
surfpodcastnetwork.com
valkyrie20.com
hire4looks.com
wewalkfastasone.com
saveourschoolyear.com
5g23e.com
abusinesssystems.com
telefonepantalla.com
tailorscafe.com
schwarzer-markt.net
stopwatch247.com
458grandbetting.com
xpovision.com
kutkingbarbering.life
kppp-guxxz.xyz
chuckwagon-chow.com
la-casa-delle-vita.com
creativesocials.com
negociacoeshojebr.com
conservativestyle.life
825tache.com
birthmothersmaine.com
jwrl.net
gardiantparts.com
contodosyparaelbiendetodos.com
actymall.com
oxyde.net
adagiomusicacademy.com
newjerseyscubadiving.net
87oaks.com
overt.website
home-made-gifts.com
viralgoats.com
camediahub.com
bankruptcyprobabilities.com
yourlifematterswellness.email
earnestjourneycourses.com
landonpaints.com
aesegroup.com
omegle99.com
sparklinmomma.com
cofcwzrf.com
jam-nins.com
mazacz.com
copdrule.info
cahayaqq.life
helps-paxful.com
gerado.online
patanamedia.com
fromfeartotrust.com
deux-studios.com
wallinders.com
nilton-g.com
yijiamobile.com
ocheap3dbuy.com
flima2020a.site
battlefieldtitle.site
ferrebaviera.com
plushmint.com
achievementfound.com
dontbringcovidhome.com
cultigique.com
waveplumb.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/968-69-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/968-70-0x000000000041ED60-mapping.dmp formbook behavioral1/memory/1900-77-0x00000000000C0000-0x00000000000EE000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1184 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Documents pdf.exeDocuments pdf.exechkdsk.exedescription pid process target process PID 1888 set thread context of 968 1888 Documents pdf.exe Documents pdf.exe PID 968 set thread context of 1260 968 Documents pdf.exe Explorer.EXE PID 1900 set thread context of 1260 1900 chkdsk.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
Documents pdf.exechkdsk.exepid process 968 Documents pdf.exe 968 Documents pdf.exe 1900 chkdsk.exe 1900 chkdsk.exe 1900 chkdsk.exe 1900 chkdsk.exe 1900 chkdsk.exe 1900 chkdsk.exe 1900 chkdsk.exe 1900 chkdsk.exe 1900 chkdsk.exe 1900 chkdsk.exe 1900 chkdsk.exe 1900 chkdsk.exe 1900 chkdsk.exe 1900 chkdsk.exe 1900 chkdsk.exe 1900 chkdsk.exe 1900 chkdsk.exe 1900 chkdsk.exe 1900 chkdsk.exe 1900 chkdsk.exe 1900 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Documents pdf.exechkdsk.exepid process 968 Documents pdf.exe 968 Documents pdf.exe 968 Documents pdf.exe 1900 chkdsk.exe 1900 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Documents pdf.exechkdsk.exedescription pid process Token: SeDebugPrivilege 968 Documents pdf.exe Token: SeDebugPrivilege 1900 chkdsk.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
Documents pdf.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1888 wrote to memory of 1076 1888 Documents pdf.exe schtasks.exe PID 1888 wrote to memory of 1076 1888 Documents pdf.exe schtasks.exe PID 1888 wrote to memory of 1076 1888 Documents pdf.exe schtasks.exe PID 1888 wrote to memory of 1076 1888 Documents pdf.exe schtasks.exe PID 1888 wrote to memory of 968 1888 Documents pdf.exe Documents pdf.exe PID 1888 wrote to memory of 968 1888 Documents pdf.exe Documents pdf.exe PID 1888 wrote to memory of 968 1888 Documents pdf.exe Documents pdf.exe PID 1888 wrote to memory of 968 1888 Documents pdf.exe Documents pdf.exe PID 1888 wrote to memory of 968 1888 Documents pdf.exe Documents pdf.exe PID 1888 wrote to memory of 968 1888 Documents pdf.exe Documents pdf.exe PID 1888 wrote to memory of 968 1888 Documents pdf.exe Documents pdf.exe PID 1260 wrote to memory of 1900 1260 Explorer.EXE chkdsk.exe PID 1260 wrote to memory of 1900 1260 Explorer.EXE chkdsk.exe PID 1260 wrote to memory of 1900 1260 Explorer.EXE chkdsk.exe PID 1260 wrote to memory of 1900 1260 Explorer.EXE chkdsk.exe PID 1900 wrote to memory of 1184 1900 chkdsk.exe cmd.exe PID 1900 wrote to memory of 1184 1900 chkdsk.exe cmd.exe PID 1900 wrote to memory of 1184 1900 chkdsk.exe cmd.exe PID 1900 wrote to memory of 1184 1900 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Documents pdf.exe"C:\Users\Admin\AppData\Local\Temp\Documents pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PwTRIU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9F99.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Documents pdf.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Documents pdf.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9F99.tmpMD5
04c5fd336d57e7f20d095aa34d4de682
SHA1dd7d70a25ed71b55a2a94a6640bd8bbcbb160194
SHA25619ebde9134944891107f8ea1b188e803d6ecf9a29b1f167ee6bb2ebbec2a2a7c
SHA512d8c584f5146ca6fc22cead0c107a6430d59757c380bc7c1e223a317aa9970a03df06aa41af4e68f3bfc61b4314de699365bc3f41fae77d40548ffddddc1dc053
-
memory/968-71-0x0000000000A00000-0x0000000000D03000-memory.dmpFilesize
3.0MB
-
memory/968-72-0x0000000000180000-0x0000000000194000-memory.dmpFilesize
80KB
-
memory/968-70-0x000000000041ED60-mapping.dmp
-
memory/968-69-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1076-67-0x0000000000000000-mapping.dmp
-
memory/1184-75-0x0000000000000000-mapping.dmp
-
memory/1260-73-0x0000000004DF0000-0x0000000004EC7000-memory.dmpFilesize
860KB
-
memory/1260-80-0x0000000004F70000-0x00000000050D9000-memory.dmpFilesize
1.4MB
-
memory/1888-63-0x0000000004A85000-0x0000000004A96000-memory.dmpFilesize
68KB
-
memory/1888-66-0x0000000000B50000-0x0000000000B8A000-memory.dmpFilesize
232KB
-
memory/1888-62-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/1888-61-0x00000000004A0000-0x0000000000507000-memory.dmpFilesize
412KB
-
memory/1888-64-0x00000000002F0000-0x00000000002F2000-memory.dmpFilesize
8KB
-
memory/1888-59-0x0000000010710000-0x0000000010711000-memory.dmpFilesize
4KB
-
memory/1888-65-0x0000000004C70000-0x0000000004CFA000-memory.dmpFilesize
552KB
-
memory/1900-74-0x0000000000000000-mapping.dmp
-
memory/1900-76-0x0000000000640000-0x0000000000647000-memory.dmpFilesize
28KB
-
memory/1900-77-0x00000000000C0000-0x00000000000EE000-memory.dmpFilesize
184KB
-
memory/1900-78-0x0000000002180000-0x0000000002483000-memory.dmpFilesize
3.0MB
-
memory/1900-79-0x0000000001EB0000-0x0000000001F43000-memory.dmpFilesize
588KB